CVE-2023-3786 Aures Komet Kiosk Mode access control
Physical attackers can bypass access controls in Aures Komet kiosk mode to gain unauthorized privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3786?
CVE-2023-3786 is a medium-severity missing authorization vulnerability in Aures Komet, published on 20 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as problematic has been found in Aures Komet up to 20230509. This affects an unknown part of the component Kiosk Mode. The manipulation leads to improper access controls. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-235053 was assigned to this vulnerability.
Weakness: CWE-284
Which versions are affected by CVE-2023-3786?
It affects 1 product.
Products include Aures Komet Firmware.
How do I fix CVE-2023-3786?
No fix has been published for CVE-2023-3786 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-3786 being exploited?
There is no known exploitation of CVE-2023-3786 in the wild and no public exploit code.
Sources
Also known as GHSA-ff5p-pc9j-wj2w.